{"id":"CVE-2024-2383","published":"2024-06-06T18:18:29Z","modified":"2024-08-01T19:11:53Z","title":"Clickjacking Vulnerability in zenml-io/zenml","vendor":"zenml-io","product":"zenml-io/zenml","tier":"tail","description":{"text":"A clickjacking vulnerability exists in zenml-io/zenml versions up to and including 0.55.5 due to the application's failure to set appropriate X-Frame-Options or Content-Security-Policy HTTP headers. This vulnerability allows an attacker to embed the application UI within an iframe on a malicious page, potentially leading to unauthorized actions by tricking users into interacting with the interface under the attacker's control. The issue was addressed in version 0.56.3.","provenance":"source","from":"CVE.org"},"cvss":{"score":4.3,"severity":"MEDIUM","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00357,"percentile":0.29448,"provenance":"source"},"cwes":[{"id":"CWE-1021","name":"Improper Restriction of Rendered UI Layers or Frames"}],"references":[{"url":"https://huntr.com/bounties/22d26f5a-c0ae-4344-aa7d-08ff5ada3963","tags":[]},{"url":"https://github.com/zenml-io/zenml/commit/f863fde1269bc355951f8cfc826c0244d88ad5e9","tags":[]}],"priority":{"score":8.9,"factors":[{"name":"EPSS percentile","points":5.89},{"name":"CVSS severity","points":3.01}]},"vendorSlug":"zenml-io","affectedVersions":[{"vendor":"zenml-io","product":"zenml-io/zenml","versions":[">= unspecified, < 0.56.3"]}],"affected":[{"ecosystem":"PyPI","package":"zenml","vulnerableRanges":["<0.56.3"],"patched":["0.56.3"],"from":["GHSA-mq73-g4qr-fgcq","PYSEC-2024-194"],"provenance":"source"}],"euvd":{"id":"EUVD-2024-0198","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-zenml-io-zenml-cve-2024-2035","parents":[{"from":"CVE-2024-2035","to":"CVE-2024-2383","relation":"successor","confidence":"high","kind":"lineage","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:zenml","fromFixed":"0.56.2","toFixed":"0.56.3","daysApart":0},{"kind":"same-code","provenance":"machine","files":["src/zenml/zen_server/utils.py"],"commits":["https://github.com/zenml-io/zenml/commit/b95f083efffa56831cd41d8ed536aeb0b6038fa3","https://github.com/zenml-io/zenml/commit/f863fde1269bc355951f8cfc826c0244d88ad5e9"],"basis":"rarely changed file"}]}],"packageHistory":[{"cve":"CVE-2024-2171","published":"2024-06-06","fixed":"0.56.2","kev":false},{"cve":"CVE-2024-2260","published":"2024-04-16","fixed":"0.56.2","kev":false},{"cve":"CVE-2024-2213","published":"2024-06-06","fixed":"0.56.3","kev":false},{"cve":"CVE-2024-2383","published":"2024-06-06","fixed":"0.56.3","kev":false},{"cve":"CVE-2024-4311","published":"2024-11-14","fixed":"0.57.0rc2","kev":false},{"cve":"CVE-2024-5062","published":"2024-06-30","fixed":"0.58.0","kev":false},{"cve":"CVE-2024-9340","published":"2025-03-20","fixed":"0.68.0","kev":false}],"package":"PyPI:zenml"}}